Monitoring input/output operations to specific storage locations

Abstract

Provided are techniques for storing one or more storage rules for each of one or more storage locations, along with one or more actions to be taken for each storage rule that is violated, intercepting an I/O operation issued to the storage subsystem, and determining whether the I/O operation violates one or more of the storage rules. In response to determining that the I/O operation violates one or more of the storage rules, an application that issued the I/O operation is identified and each of the one or more actions associated with the one or more violated storage rules are performed.

The invention claimed is: 
     
       1. A method, comprising:
 storing one or more storage rules for each of one or more storage locations on a storage subsystem, along with one or more actions to be taken for each storage rule that is violated, wherein each of the storage rules identifies a storage location and at least one of a format of data and a pattern of the data at that storage location; 
 intercepting an Input/Output (I/O) operation issued to the storage subsystem, wherein the I/O operation specifies a storage location; 
 before the I/O operation is issued to the storage subsystem, determining whether the I/O operation violates one or more of the storage rules by matching at least one of a format of data and a pattern of data of the I/O operation against the at least one of the format of data and the pattern of data in the one or more storage rules for the storage location specified in the I/O operation; 
 in response to determining that the I/O operation violates one or more of the storage rules,
 identifying an application that issued the I/O operation; and 
 performing each of the one or more actions associated with the one or more of the violated storage rules; and 
 
 in response to determining that the I/O operation does not violate one or more of the storage rules, allowing the I/O operation to pass to the storage subsystem. 
 
     
     
       2. The method of  claim 1 , wherein the I/O operation is one of a read operation and a write operation. 
     
     
       3. The method of  claim 1 , further comprising:
 monitoring I/O operations issued to the storage subsystem. 
 
     
     
       4. The method of  claim 1 , wherein the one or more actions are selected from a group of actions comprised of: blocking the I/O operation from passing to the storage subsystem, notifying a user of the violating I/O operation and the application, and logging the violating I/O operation. 
     
     
       5. A system, comprising:
 a processor; and 
 storage coupled to the processor, wherein the storage stores a computer program, and wherein the computer program is executed by the processor to perform operations, the operations comprising:
 storing one or more storage rules for each of one or more storage locations on a storage subsystem, along with one or more actions to be taken for each storage rule that is violated, wherein each of the storage rules identifies a storage location and at least one of a format of data and a pattern of the data at that storage location; 
 intercepting an Input/Output (I/O) operation issued to the storage subsystem, wherein the I/O operation specifies a storage location; 
 before the I/O operation is issued to the storage subsystem, determining whether the I/O operation violates one or more of the storage rules by matching at least one of a format of data and a pattern of data of the I/O operation against the at least one of the format of data and the pattern of data in the one or more storage rules for the storage location specified in the I/O operation; 
 in response to determining that the I/O operation violates one or more of the storage rules,
 identifying an application that issued the I/O operation; and
 performing each of the one or more actions associated with the one or more of the violated storage rules; and 
 
 
 in response to determining that the I/O operation does not violate one or more of the storage rules, allowing the I/O operation to pass to the storage subsystem. 
 
 
     
     
       6. The system of  claim 5 , wherein the I/O operation is one of a read operation and a write operation. 
     
     
       7. The system of  claim 5 , wherein the operations further comprise:
 monitoring I/O operations issued to the storage subsystem. 
 
     
     
       8. The system of  claim 5 , wherein the one or more actions are selected from a group of actions comprised of: blocking the I/O operation from passing to the storage subsystem, notifying a user of the violating I/O operation and the application, and logging the violating I/O operation. 
     
     
       9. A computer program product, the computer program product comprising:
 a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code, when executed by a processor of a computer, is configured to perform:
 storing one or more storage rules for each of one or more storage locations on a storage subsystem, along with one or more actions to be taken for each storage rule that is violated, wherein each of the storage rules identifies a storage location and at least one of a format of data and a pattern of the data at that storage location; 
 intercepting an Input/Output (I/O) operation issued to the storage subsystem, wherein the I/O operation specifies a storage location; 
 before the I/O operation is issued to the storage subsystem, determining whether the I/O operation violates one or more of the storage rules by matching at least one of a format of data and a pattern of data of the I/O operation against the at least one of the format of data and the pattern of data in the one or more storage rules for the storage location specified in the I/O operation; 
 in response to determining that the I/O operation violates one or more of the storage rules,
 identifying an application that issued the I/O operation; and
 performing each of the one or more actions associated with the one or more of the violated storage rules; and 
 
 
 in response to determining that the I/O operation does not violate one or more of the storage rules, allowing the I/O operation to pass to the storage subsystem. 
 
 
     
     
       10. The computer program product of  claim 9 , wherein the I/O operation is one of a read operation and a write operation. 
     
     
       11. The computer program product of  claim 9 , wherein the computer readable program code, when executed by the processor of the computer, is configured to perform:
 monitoring I/O operations issued to the storage subsystem. 
 
     
     
       12. The computer program product of  claim 9 , wherein the one or more actions are selected from a group of actions comprised of: blocking the I/O operation from passing to the storage subsystem, notifying a user of the violating I/O operation and the application, and logging the violating I/O operation.